Examiner-ready evidence on a continuous cadence. Not the night before. Rozmith runs IT, cybersecurity, and NCUA-aligned GRC for Southeast credit unions as one accountable team — GuidePoint-grade governance at regional-firm pricing.
The Pain
NCUA examiners aren't asking your MSP nice questions about uptime. They're asking about ACET maturity, third-party assessor findings, ACH/wire fraud controls, member data protection, and continuous evidence. If your MSP can't answer in the room, you answer in the room. That's the problem.
01 — Exam Findings
The same control gaps show up because the help desk closes tickets but nobody owns the control. Findings compound. So does examiner attention.
02 — Third-Party Risk
NCUA wants evidence that you're actually monitoring your vendors — not just a spreadsheet someone updated last June.
03 — Fraud Exposure
Member-facing fraud is the headline risk. The controls — authentication, transaction monitoring, dual approval — are where most CU stacks have quiet gaps.
04 — The Cost of Building This Internally
For a $250M–$2B CU, that math doesn't work. So most CUs run lean and hope the next exam goes okay.
How We Work
The credit union stack is full of things that look fine until an examiner looks at them. We come in for an assessment first. We show you, with audit-grade evidence, what's actually broken. Then we have an honest conversation about who fixes it.
"You need brake pads. A rotation. A few other things." That's the conversation. With evidence. Not vibes.
NCUA-aligned cyber + IT gap analysis. Pen test or phishing if the scope calls for it.
You get a findings package an examiner would respect. Mapped to ACET, FFIEC, NIST CSF.
We close the gaps. Either you run our playbook in-house, or we run it for you. Your call.
If it makes sense, we move into MSP / MSSP / GRC-as-a-Service. Continuous evidence, one accountable team.
Proof — Anonymized
We don't name clients. Our anonymity rules are strict — that's the same posture we'll take with you. Here's the pattern.
Pattern — Regulated Mid-Market Financial Services Client
Before: separate firms for help desk, SOC, and GRC. Three vendors, three contracts, three sets of finger-pointing every time an exam came up. Findings repeated year over year because nobody owned the control end-to-end.
After: one team across IT, security, and GRC. Apptega-powered continuous evidence mapped to NCUA, FFIEC, and NIST CSF. Phishing dwell time measured in minutes. Vendor risk on a real cadence. Examiner walks in, evidence walks out.
We run regulated mid-market clients across the Southeast US. Anonymized references available under NDA.
Lead Magnet
The control map we wish every CIO at a Southeast credit union had three months before their cyber exam. Free. No sales call attached — but if you want one, the box is there.
Talk To Us
No deck. No slides. A working conversation: where you are, what your last exam said, where the noise is. If a paid assessment makes sense, we'll scope it. If it doesn't, we'll say so.
FAQ
Either. Most engagements start as an assessment — that's vendor-agnostic and doesn't disturb anything. From there, the credit union picks the model: keep the incumbent and bolt us on for security + GRC, or move the whole stack to one accountable team. We've done both.
Our control set is mapped to NCUA ACET maturity domains, the FFIEC IT examination handbook, and NIST CSF 2.0 — through Apptega, our GRC platform of record. Evidence is continuous, not point-in-time. When the examiner asks "show me," the answer is one click, not a fire drill.
Our sweet spot in this vertical is $250M–$2B in assets, single-state or multi-state. Below that, the math gets tight. Above that, the stack often justifies a dedicated internal CISO that we partner with rather than replace.
Yes — Microsoft CSP/MVP, Fortinet, Mimecast, Tanium are partners. EDR via CrowdStrike or SentinelOne depending on the fit. Tenable for vulnerability and exposure. Apptega for GRC. We don't push tools we don't operate ourselves.
Member-data-grade controls are the baseline, not the upsell — DLP, encryption, access governance, IRM, privileged access management. Mapped to NCUA Part 748 Appendix A/B and FFIEC information security.
An assessment runs 3–6 weeks. From there, MSP/MSSP transitions for a CU your size usually land inside 60–90 days. We co-build the runbook with your team so there's no "go-live cliff."